Logo
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Forensic Discoveries Newsletter

February 2010
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Welcome to Forensic Discoveries' eDiscovery and Digital Forensics Newsletter. Keeping you and your practice informed of the ever-changing realm and value of Electronic Discovery and Digital Forensics is the purpose of this newsletter. If you have a colleague that may be interested in subscribing, follow the instructions at the bottom of this newsletter to be added to the distribution. If you choose not to continue receiving this newsletter, follow the directions at the bottom of this newsletter and accept our apologies for intruding.
in this issue
Don't Kill The Lawyers
E-Discovery: Did You Know?
Itsy-Bitsy, Teeny-Weeny E-Discovery
Web Searches Serve as a Litigation Tool
Time to Review Corporate Computer Policies
Upcoming Speaking Engagements and Publications
EDiscovery Case Law
Previous Newsletters
 
We hope you enjoyed our last newsletter. Due to a steady increase in new subscribers, Forensics Discoveries will continue to list previous newsletters. As others have done, please let us know of a specific topic you would like to see covered.

We have added a new newsletter archive section to our website. The improved archive interface provides the same interaction with the newsletter as the distributed newsletter. View the new newsletter archive here.

 Below is a review of our previous newsletters:
 

August 2007 - "What is Computer Forensics?"

September 2007 - "Preparing Your Clients for EDiscovery - Part 1"
October 2007 - "Preparing Your Clients for EDiscovery - Part 2"
November 2007 - "Preparing for Your Clients' EDiscovery"
December 2007 - "Why Does My Case Need Electronic Discovery?"
February 2008 - "Computer Forensics Proves Intelletual Property Theft"
March 2008 - "In Search of the Holy Grail"
May 2008 - "When to Preserve"
June 2008 - "Electronic Discovery in Workplace Litigation"
July 2008 -
"Proving Spoliation with Computer Forensics"
August 2008 - "Proposed Updated TN Rules of Civil Procedure"

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Computer Forensics in Employment Defense


Due to the massive layoffs our country has experienced through this recession and the inability for much of that workforce to obtain new jobs, employment litigation is currently a focal point for attorneys representing employers. There are many standard practices that employers should follow when terminating an employee, but one of the most valuable steps is often overlooked. The potentially most valuable resource to defend employment matters could be the company issued phones and computers. With the proper acceptable computer usage policies in place, the digital evidence in the employer's possession could contain the information needed to successfully defend the suit.

For the majority of today's workforce, the lines between business and personal lives no longer exist. The majority of employees today work during their personal time and conduct personal business while at work. The primary tool for work and personal activities is technology of some flavor. Until recently, it was routine for employees to conduct personal conversations primarily via email, both using the company email system and personal email accounts typically not logged by the company (Gmail, hotmail, etc). However with the recent explosion of social networking sites, email is now combined with Facebook, MySpace, and Twitter communications just to note a few. If you currently have a Facebook account, you can test this theory. Analyze the times of status updates for your Facebook "friends" and note the times of the posts. Or simply look to see who is online with the Facebook system during periodic times during the workday. I want to be clear that this is not an indication of someone's dedication to his or her work, but the culture shift. It is likely that those with even those with the most stringent work ethic will participate in these activities during business hours, the lines between work and personal lives are eroding.  Combining email and social networking sites with detailed Internet activities, research, personal pictures, and other activities performed on their work computer or mobile phone may provide an unintentional diary that will aid in your employment litigation matters. 

Now that the stage has been set for the value of digital technology in employment litigation, let's be sure the appropriate paperwork is in place. As case law has demonstrated, just because the company owns the asset that this information is located does not necessarily guarantee that it can be accessed and reviewed. As the "Time to Review Corporate Computer Policies" article in this newsletter states, companies need to be certain that the appropriate acceptable usage policies for corporate technology is in place before issues arise that will benefit from leveraging this information. The above mentioned article outlines three good examples of "loopholes" in the policies that prevented crucial information from being leveraged in employment matters and provides tips for tighten up the policies for your clients.

With everything in place, let's apply digital forensics to routine employment litigation:

Let's start with a sexual harassment case in which the plaintiff accused a superior of sexual harassment and filed suit. Leveraging digital forensics discovered thousands of Facebook chat messages, Internet activity, and deleted emails with pictures attached confirming that the relationship was mutual and that the superior had actually tried to end the relationship numerous times.

In a wrongful termination suit, the information technology manager was terminated for a number reasons, including an inappropriate relationship with a co-worker that was denied. Digital forensics was leveraged to recover more than 200 text messages from a smartphone that was inadvertently backed up to a corporate computer, important explicit images were found, recovered Internet history confirming secure communication with the coworker, evidence demonstrating abuse of authority by checking the email of superiors, and detailed efforts of spoliation to destroy important information. All of the information was gathered from the technology assets within the defendant's possession.

In a worker's compensation suit after an accident at work, the plaintiff claimed medical conditions that diminished the quality of life. A digital forensic investigation discovered extensive research on the claimed conditions. However the Internet research did not detail treating or living with the conditions, the research performed was specific to worker's compensation calculators, workers compensation attorneys, and the physical symptoms of the extraordinary conditions that were demonstrated during depositions. In addition there were personal pictures taken of the plaintiff after the incident while at a sporting event, enjoying a family beach vacation, camping, jumping off of a rock cliff into a lake, and jumping off of a bridge into a lake. 

Electronically stored information must also be handled properly when asked to produce in litigation. Remember that the "Genesis" of eDiscovery as we know it today started with Zubulake v USB Warburg, a "routine" employee discrimination suit. In another routine eDiscovery request in a wrongful termination suit, the defendant failed to properly preserve and produce emails requested. The defense also did not produce emails from two named custodians and failed to properly preserve the laptops used by these custodians. When the plaintiff produced emails that the defense did not, problems quickly arose for the defendant. In the majority of all case law in which the defendant is sanctioned, it is due to lack of proper identification and preservation.

In today's challenging environment of employment litigation defense, this potential wealth of valuable information might very well be in the possession of your client and ready for your use to defend them. The challenges that you face will be ensuring that the proper acceptable usage policies are in place and that the data is properly preserved. Company issued laptops, mobile phones, email servers, shared files servers, and even electronic badge systems may contain the proverbial "smoking gun" for your case. It is also possible to determine whether or not value exists before making a large investment. As an example, we have what we call our "early case assessment" procedure in which we can quickly search for keywords, determine all documents accessed, applications executed, and a quick Internet usage analysis in a minimal amount of time. This information helps our clients to determine whether or not to continue with a full investigation of the digital device.

 

 


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Don't Kill The Lawyers - When Courts Demand ESI, IT & Legal Counsel Must Work Together


There are two very good points that this article highlights. The first is the essential  and effective communications with the technical resources when litigation involves eDiscovery.The second is that a knowledgeable technical resource can be your best friend when preparing for the 26(f) meet and confer. As a Federal Judge that I speak with pertaining to eDiscovery states, "If you don't know what you are doing when it comes to technology, find someone that does."

"How would you enjoy spending 9% of your company's entire revenue for a year, not on new IT or data center capabilities but because of a big, fat mistake? Would you enjoy explaining to your CEO that you made the mistake not through an error of judgment, but from complete and total ignorance of the situation and its implications?"

Read the entire article here.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

E-Discovery: Did You Know?

Wonderful, informative, and entertaining movie pertaining to eDiscovery that was unveiled recently at LegalTech. Watch the video here.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Itsy-Bitsy, Teeny-Weeny E-Discovery

 

Great info in this article for attorneys in small firms and solo practitioners.


"E-discovery was once the sole concern of large law firms involved in large-scale litigation. But as EDD increasingly becomes an issue in smaller cases for smaller law firms, small and solo lawyers are learning some hard lessons about electronic evidence in litigation."


Read the entire article from Law Technology News here.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

Web Searches Serve as a Litigation Tool

"Social networking websites and other Internet forums have, to differing degrees, eroded the personal privacy of their users. Often, this erosion is unintentional; often the technology and the information it reveals is not thoroughly understood; and often a third party's ability to collect substantial and qualitatively important amounts of information is underestimated."

Read the entire article from Law Technology News here.

On a similar topic, the Knoxville News Sentinel recently published an interesting article titled "Facebook Key Tool in Divorce Cases", read the articlehere.



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

       

      Time to Review Corporate Computer Policies


"Three recent court decisions make it important for companies to begin the new year with a thorough review of their computer-use policies with a focus on two issues: ensuring that employees have no expectation of privacy in using the company computer systems and delineating the scope of the employee's permissible access to the company computers. This article will discuss these three decisions and their implications for creating effective corporate computer policies that protect the company against the theft of its data."

Read the entire article here


Also read more information on this topic in this month's feature article above

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
 
Upcoming Speaking Engagements and Publications


  Smoky Mountain Paralegal Association - "eDiscovery - No Where to Hide"

March 11th, 2010
US Department of Justice Offices (Knoxville, TN)
more info here

Internal Auditors Association - "Electronic Discovery for Today's Companies"

March 11th, 2010
 New Harvest Park Community Building (Knoxville, TN)
more info
here


Knoxville BAR Association - Federal Court Bench and BAR Conference

May 14th, 2010

United States Magistrate Judge Clifford Shirley, Chuck Young from Kramer Rayson, and I will again provide an eDiscovery presentation.

 

TLAW/TBA - "eDiscovery for Small and Solo Firms"

June 3rd, 2010

Nashville, TN

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
EDiscovery Case Law

Court Finds E-Mails Stored on Old Archiving System Reasonably Accessible; Costs Exaggerated

Starbucks Corp. v. ADT Sec. Servs., Inc., 2009 WL 4730798 (W.D. Wash. Apr. 30, 2009).

In this discovery dispute, the plaintiff sought production of e-mails from a specified time period. The defendant argued the e-mails were archived on the company's "cumbersome" old system and were not reasonably accessible under Fed.R.Civ.P 26(b)(2)(B). In support of the position, the defendant's information technology representative made several claims, including that accessing the e-mails would be disruptive to business operations and would take nearly four years to restore. The representative also provided an initial cost estimate for the work of $88,000, but upped the ante six months later to $834,285. The court noted that the representative "provided exaggerated reasons and exaggerated expenses as to why the [defendant] allegedly [could not] or should not be ordered to comply with its discovery obligations." The court found that the plaintiff should not be disadvantaged since the defendant, a "sophisticated" company, chose not to migrate the e-mails to the now-functional archival system and thus determined that the e-mails were reasonably accessible. Furthermore, the court explained that even if the information was ruled not reasonably accessible, good cause existed to order production.

 

Court Finds $8 Million Default Judgment for Discovery Violations Not Abuse of Discretion

MagaƱa v. Hyundai Motor Am., 220 P.3d 191 (Wash. Nov. 25, 2009).

In this personal injury action, the Supreme Court of Washington reviewed the Court of Appeals' reversal of the trial court's imposition of a default judgment sanction on the defendant corporation. Among the defendant's violations: the defendant limited the search for documents to its legal department; made false, misleading and evasive responses; and willfully violated discovery rules. Arguing that the plaintiff's discovery requests were overly broad, the defendant claimed that the harshness of a default judgment sanction was not warranted. The court noted that the defendant is a "sophisticated multinational corporation experienced in litigation," and it analyzed the three factors assessed by the trial court to determine the appropriateness of a default judgment sanction - willfulness of violation, substantial prejudice to opposing party and availability of lesser sanctions. The court found that the record reasonably and substantially supported the trial court's conclusion, and it reinstated the $8 million default judgment.

 

Court Holds Party in Contempt of Court and Issues Sanctions for Use of Wiping Software

TR Investors, LLC v. Genger, 2009 WL 4696062 (Del. Ch. Dec. 9, 2009).


In this stockholders litigation, the plaintiffs sought default judgment sanctions, citing the defendant's destruction of electronic evidence in violation of a court order. The plaintiffs asserted that, following review and encryption of electronic evidence by a third-party firm, the defendant used wiping software to permanently delete temporary files in the unallocated space not reviewed by the neutral party for relevance. The defendant, an "international man of mystery" who performed sensitive tasks for the Israeli government and was concerned about the confidentiality of personal documents, claimed that he believed the wiping software only deleted duplicate copies. Finding the use of wiping software to be a clear violation of the unambiguous court order, the court determined sanctions were appropriate. The court declined to impose a default judgment and held the defendant in contempt, ordering him to pay $750,000 in attorneys' fees and costs. The court also ordered production of documents previously subject to a claim of privilege, elevated the defendant's required burden of persuasion on any counterclaims or defenses, and prohibited the defendant from prevailing on any material matter based solely on his uncorroborated testimony.

 

Court Allows Forensic Imaging of Hard Drives Containing Medical Records

Cornwell v. N. Ohio Surgical Ctr., Ltd., 2009 WL 5174172 (Ohio App. 6 Dist. Dec. 31, 2009).

In this wrongful death litigation, the defendants appealed the trial court's ruling allowing the plaintiff's forensic expert to create a mirror image of the defendants' hard drives. The defendants asserted such intrusive access was not authorized under Fed.R.Civ.P. 34 and would violate prohibitions against the disclosure of confidential medical information. In affirming the trial court's order, the appellate court dismissed the confidentiality argument, relying on testimony of the plaintiff's expert explaining that viewing confidential information was not necessary to the forensic imaging process. The court also discarded the defendants' Rule 34 argument, noting that the circumstances surrounding the case gave rise to an inference of improper conduct on part of the defendants. In further support of the trial court's decision, the court noted the direct relationship between the plaintiff's claims and the hard drives and said the specific protocol and search terms established by the trial court made the defendants' arguments meritless.

 

Court Imposes Adverse Inference Sanction for Party's Failure to Preserve Telephone Message

Vagenos v. LDG Fin. Servs., LLC., 2009 WL 5219021 (E.D.N.Y. Dec. 31, 2009).

In this action brought under the Fair Debt Collection Practices Act, the defendant moved to prevent the plaintiff from offering at trial an alleged duplicate of the automated telephone message that served as the basis of the suit. The defendant asserted that the original message was destroyed with malicious intent and therefore was inadmissible. In opposition, the plaintiff maintained that the destruction of the original message was due to a change in cellular service providers and testified that the recording reflected the original. Despite finding no evidence of bad faith, the court determined that the plaintiff's duty to preserve evidence was breached. The court declined to preclude the evidence since it would be the "death knell" of the case, but it found an adverse inference sanction appropriate. In making this determination, the court noted that the destruction and the plaintiff attorney's failure to inform his client of the preservation duty were especially "egregious" and "highly troubling."



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Forensic Discoveries is available to provide onsite presentations or Q&A sessions on topics such as Electronic Discovery, Technical Implications of the updated Federal Rules of Civil Procedure, or Computer Forensics. Forensic Discoveries is also available to you, obligation free, to answer any specific questions pertaining to these topics. Simply give us a call and we will be glad to answer any questions pertaining to Electronic Discovery and Digital Forensics.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

a division of Sword & Shield

   Knoxville Office

   Phone:    (865)-244-3500

   Address:  1431 Centerpoint Blvd, Suite 150

                  Knoxville, TN 37932


   Washington D.C. Office

   Phone:    (410)-414-5580

   Address:  1425 K Street NW, Suite 350

                 Washington, DC 20005-3514


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

If you have a topic that you would like addressed in the newsletter, please let us know. Either visit http://www.forensicdiscoveries.com/newsletter.html and submit your suggestion there or reply to this e-mail with your suggestion. 

For previous versions of Forensic Discoveries EDiscovery newsletters, click here 

This document does not provide legal or other professional advice and should not be relied upon as anything other than a starting point for research and information on the subject of electronic evidence and digital forensics.